Splunk Search

How to add inputlookup and outputlookup in same search

yuwtennis
Communicator

Hi!

I would like to know if it is possible to add outputlookup and inputlookup in same search.
My purpose is to create a table dynamically and use it in other sub searches.

I thought this can be possible by using subsearches but bit struggling with it.

index=hoge
[ sub search
outputlookup
return ""
]
[ | inputlookup xxxxx]

but alsways the inputlookup runs before the outputlookup.

Any suggestions ?

Thanks,
Yu

Tags (2)
0 Karma

splunkdevabhi
Explorer

eventtype=snow_cmdb_ci_list | dedup sys_id | fields - _bkt, _cd,_indextime,_kv,_raw,_serial,_si,_sourcetype,_subsecond, punct, index, source, sourcetype | inputlookup append=t cmdb_ci_list_lookup | dedup sys_id | outputlookup cmdb_ci_list_lookup

0 Karma

Ayn
Legend

Subsearches always run before the outer searches, as for the order in which subsearches themselves run I don't think there's a guaranteed order for that.

Please tell us more about exactly what you want to accomplish, with examples.

splunkdevabhi
Explorer

Found one such example from Splunk Add-on for ServiceNow :

eventtype=snow_cmdb_ci_list | dedup sys_id | fields - _bkt, _cd,_indextime,_kv,_raw,_serial,_si,_sourcetype,_subsecond, punct, index, source, sourcetype | inputlookup append=t cmdb_ci_list_lookup | dedup sys_id | outputlookup cmdb_ci_list_lookup

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...